Your data, in plain English.

Last updated: 29 May 2026

Who we are

theHRkey is an AI-native HR & resourcing practice operated by Ali Akeel, sole trader, based in the United Kingdom. We are the data controller for any personal data you submit through this site. Reach us at info@thehrkey.com.

What we collect

Contact details you give us in the chatbot or forms (name, email, phone, company).
Your CV if you upload one — file + extracted text + AI-derived classification.
Job applications we generate or send on your behalf.
Anonymous analytics (page views, referrer, device class), only if you've consented to analytics cookies.
Essential session data (login session, chat session id) needed to make the site work.

Why we collect it

To answer your enquiry and route it to the right practitioner.
To match your CV against live job openings (if you upload one).
To generate tailored applications you've explicitly asked us to produce.
To run our HR / resourcing services for clients who instruct us.
To improve the agentic pipelines that power the site, using only data you've consented to share.

Lawful basis (UK GDPR)

Consent — analytics cookies, marketing emails, sharing your CV with named employers.
Contract — providing the services you've engaged us for.
Legitimate interest — answering your enquiry, securing the site, fraud prevention.

Who we share data with

Named employers — only with your explicit per-application consent, never speculatively.
Sub-processors that run the site: NameCheap (hosting and email); Google (Gemini API, for the limited purposes below); GitHub, which holds an encrypted off-site copy of our backups.
Nobody else. We do not sell, rent or share your data with advertisers, data brokers, or other agencies.

How long we keep it

Each period runs from your last activity with us, not from when we first collected something.

What	How long	Why that long
Your profile and CV	24 months after your last activity	So we can keep putting you forward without asking you to start again. Delete it sooner at any time.
Records of roles we discussed with you, and who we approached	At least 12 months	Required of employment agencies by the Conduct of Employment Agencies and Employment Businesses Regulations 2003.
Placement and invoice records	6 years	Accounting and tax obligations where a fee was charged.
Chat transcripts	24 months	To answer follow-up questions and improve the service.
A record that you asked not to be contacted	Kept indefinitely	It is the only thing stopping us contacting you again. See below.
Anonymous analytics	14 months	Provider default.

What we send to Google's Gemini API

We do not send your CV to Google. CVs are read on our own server and stay there. We use Gemini for three narrow things:

Sorting incoming email. The subject and up to the first 3,000 characters of a message sent to us are classified so it reaches the right place. If you email us, that text goes to Google. Attachments do not.
Writing interview questions. Only the job advert is sent — the role title, employer and description. No candidate details, and your answers are never sent.
The website chat assistant. Whatever you type into it.

Under the Gemini API terms this content is not used to train Google's models. If you would rather nothing you write is processed this way, say so in your message and we will handle it by hand.

How we share you with an employer

We do not give an employer your name, email address or phone number. When we put you forward, they see an anonymised profile — your experience, skills and general location under a reference such as C-4170 — and only for a role you have specifically approved. If they want to meet you, we arrange the interview ourselves. Your contact details stay with us throughout.

We keep a record of every time your details were shared, with whom, and on what basis. You can ask to see that record.

Your rights

Under UK GDPR you have the right to:

Access a copy of the data we hold about you
Correct anything wrong
Delete it (right to erasure)
Export it in a portable format
Object to processing or withdraw consent at any time
Complain to the ICO

Email info@thehrkey.com with the request. We respond within one calendar month, as UK GDPR requires. We may ask you to confirm your identity first — we are not going to hand your record to whoever asks for it.

What we cannot delete, and why

If you ask us to erase you, we remove your profile, your CV, your consents, your applications, your alert subscriptions and the content of our correspondence. Two things deliberately survive, and we would rather say so plainly than surprise you:

The fact that you asked us to stop. We keep your email address on a suppression list. If we deleted that too, nothing would stop our systems contacting you again next week. It is used for nothing else and is never marketed to.
Placement and invoice records, if we ever placed you. We are required to keep those for accounting and tax purposes. Where that applies we pseudonymise the rest of your record rather than keeping it in full.

We will tell you which of these applied to you when we confirm the erasure.

Security

We keep a nightly backup so your record survives a fault. It is encrypted with AES-256 before it leaves the server, and a copy is held in a private GitHub repository so one failure cannot lose everything. The key is not stored with the backups and not held by GitHub. Only the last 7 nights are kept off-site, and the whole set is replaced each night rather than added to — so if you ask us to erase you, you disappear from the backups too, within a week, instead of remaining in a history forever.

The site runs over TLS. Passwords are hashed with bcrypt (cost 12). CVs are stored above the web root so they can't be served accidentally. Access to the server is restricted to key-based SSH. We don't keep payment card data — that lives with our payment processor.

Cookies

See the cookie policy for the full list and how to change your mind.

Changes to this policy

If we make material changes we'll flag them on the homepage for at least 14 days and email anyone who has an account.